On Thu, Jan 12, 2006 at 01:17:55PM -0600, Aaron Griffin wrote: >On 1/12/06, Magnus Therning <[EMAIL PROTECTED]> wrote: >> Is anyone working on adding some cryptographic checksums and stuff on >> pacman packages ala secure-apt[1]? >> >> /M >> >> 1. http://wiki.debian.org/SecureApt > >I'm not sure I get the point. What would a user gain from this >encryption? Right now, md5sums decently validate a downloaded file... >it seems that secure-apt bascially just adds a check for the equivalent >of the db.tar.gz file. Is this correct?
As I understand apt/dpkg: The available .debs are listed in a Packages file. Each entry has the md5sum of the .deb. The available Packages files are listed in a Release file. Each entry has the md5sum of the Packages file. What SecureApt does is add a Release.gpg which is a signature of the Release file using a well-known key. In pacman we have, as I understand it, the md5sum of each tar-file (living in /var/lib/pacman/<repo>/<pkg>/desc. This means that I only now whether the md5sum matches the downloaded package. What I'd like to know is whether the downloaded package is the one the packager uploaded. /M -- Magnus Therning (OpenPGP: 0xAB4DFBA4) [EMAIL PROTECTED] http://therning.org/magnus Software is not manufactured, it is something you write and publish. Keep Europe free from software patents, we do not want censorship by patent law on written works. "Sendmail" and "make" are two well known programs that are pretty widely regarded as being debugged into existence. That's why their command languages are so poorly thought out and difficult to learn. It's not just you -- everyone finds them troublesome. -- Peter van der Linden, Expert C Programming, p. 220
pgp7jk0vXHtLE.pgp
Description: PGP signature
_______________________________________________ arch mailing list [email protected] http://www.archlinux.org/mailman/listinfo/arch
